Last updated: 10th July 2026 for CC Security Essentials Pro version 1.0

Introduction

CC Security Essentials Pro extends the functionality of CC Security Essentials, adding additional security features for websites that require more advanced protection and administration tools.

The core plugin already provides practical WordPress hardening, verification, Security Health monitoring and clear guidance to help you improve your website’s security.

CC Security Essentials Pro builds on these foundations by introducing additional protection for administrator accounts, stronger password management, more flexible REST API controls and enhanced security monitoring.

The two plugins work together as a single solution.

The core plugin remains responsible for the essential security features, while Pro adds further capabilities that can be enabled when they are appropriate for your website.

Before You Begin

Before installing CC Security Essentials Pro you should:

have CC Security Essentials installed and activated;
ensure your website is running a supported version of WordPress;
confirm that you have administrator access to the website.

The Pro plugin extends the core plugin and cannot operate on its own.

What Pro Adds

CC Security Essentials focuses on practical website hardening.

CC Security Essentials Pro adds features that help administrators manage security over time.

Current Pro features include:

Login Protection
Password Policies
Password Age Monitoring
Password Change Enforcement
Advanced REST Rules
Security Events
Security Logging
Enhanced Security Health
Enhanced Security Overview
Dashboard Widget enhancements

Each feature is covered in detail elsewhere in this documentation.

Who Is Pro For?

Many websites will be well served by the core plugin on its own.

CC Security Essentials Pro is particularly useful for websites that:

have multiple administrator accounts;
have several editors or contributors;
are operated by organisations;
require stronger password controls;
expose public REST API endpoints;
require additional visibility into security-related events.

The additional features can also be valuable for developers, agencies and website administrators responsible for maintaining several WordPress websites.

Installing CC Security Essentials Pro

Install and activate CC Security Essentials.
Upload the CC Security Essentials Pro plugin.
Activate the plugin through Plugins → Installed Plugins.
Open Security from the WordPress administration menu.

After activation, the additional Pro functionality becomes available automatically.

Existing settings from the core plugin remain unchanged.

What Changes After Activation?

Once Pro is activated you’ll notice several enhancements throughout the plugin.

Depending on your website configuration these may include:

additional sections within Security Health;
extra recommendations where appropriate;
new administration pages;
additional dashboard information;
advanced REST API configuration;
login security settings;
password management settings;
security event logging.

The core functionality continues to operate exactly as before.

Your Existing Settings

Activating Pro does not reset or replace your existing configuration.

Settings you’ve already configured within CC Security Essentials remain in place.

The Pro plugin simply adds additional configuration options where appropriate.

Likewise, if the Pro plugin is later deactivated, the core plugin continues providing its existing protection.

Security Philosophy

Like the core plugin, CC Security Essentials Pro follows several key principles.

Extend, Don’t Replace

The Pro plugin extends the core plugin rather than replacing it.

Essential protections remain within CC Security Essentials.

Pro builds upon those protections with additional capabilities.

Explain Before Configuring

Every security feature should help administrators understand:

what it does;
why it matters;
when it should be enabled.

Security should be understandable rather than intimidating.

Verify Where Practical

Where possible, protection should be confirmed rather than simply assumed.

Verification remains one of the defining principles of the plugin.

Privacy First

Security information remains on your website.

CC Security Essentials Pro does not send security events, passwords or administrator activity to external services.

Where security information is recorded, it is stored locally for the purpose of helping authorised administrators protect the website.

Documentation Overview

The remainder of this guide covers each Pro feature in detail.

Login Protection

Protects administrator accounts by detecting repeated failed login attempts and applying temporary restrictions where appropriate.

Password Policies

Allows password strength requirements to be configured for different WordPress roles.

Password Age Monitoring

Tracks password age and helps administrators identify accounts whose passwords may need changing.

Password Change Enforcement

Requires users to change passwords when organisational policy requires it.

REST Rules

Provides fine-grained control over individual REST API routes using allow and block rules.

Security Events

Records important security-related events to help administrators review activity on their website.

Enhanced Security Health

Extends the Security Health page with additional checks covering Pro features.

Enhanced Security Overview

Adds additional protection information to the Security Overview page while preserving the core Protection Score.

Best Practice

Many websites will choose to enable Pro features gradually.

A sensible approach is:

Configure the core plugin.
Review Security Health.
Enable Login Protection.
Configure Password Policies.
Review Password Age Monitoring.
Add REST Rules only where additional control is required.
Periodically review Security Events.

Introducing additional protection in stages makes it easier to understand how each feature affects your website.

Continue with:

CC Security Essentials Pro User Guide